diff --git a/cmd/saml2aws/commands/login.go b/cmd/saml2aws/commands/login.go
index 986c42e2b..ca22b0a8e 100644
--- a/cmd/saml2aws/commands/login.go
+++ b/cmd/saml2aws/commands/login.go
@@ -311,13 +311,14 @@ func selectAwsRole(samlAssertion string, account *cfg.IDPAccount) (*saml2aws.AWS
 func resolveRole(awsRoles []*saml2aws.AWSRole, samlAssertion string, account *cfg.IDPAccount) (*saml2aws.AWSRole, error) {
 	var role = new(saml2aws.AWSRole)
 
+	if len(awsRoles) == 0 {
+		return nil, errors.New("No roles available.")
+	}
+	if account.RoleARN != "" {
+		return saml2aws.LocateRole(awsRoles, account.RoleARN)
+	}
 	if len(awsRoles) == 1 {
-		if account.RoleARN != "" {
-			return saml2aws.LocateRole(awsRoles, account.RoleARN)
-		}
 		return awsRoles[0], nil
-	} else if len(awsRoles) == 0 {
-		return nil, errors.New("No roles available.")
 	}
 
 	samlAssertionData, err := b64.StdEncoding.DecodeString(samlAssertion)